CVE-2025-32955: fallo de gravedad media en step-security harden-runner
Harden-Runner Evasion of 'disable-sudo' policy
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6epss 0.2%
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to `disable-sudo` bypass. Harden-Runner includes a policy option `disable-sudo` to prevent the GitHub Actions runner user from using sudo. This is implemented by removing the runner user from the sudoers file. However, this control can be bypassed as the runner user, being part of the docker group, can interact with the Docker daemon to launch privileged containers or access the host filesystem. This allows the attacker to regain root access or restore the sudoers file, effectively bypassing the restriction. This issue has been patched in version 2.12.0.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Productos afectados
step-security · harden-runnerCVEs relacionadas — step-security harden-runner
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-52587LOWHarden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts`EPSS 2.8%CVE-2026-25598MEDIUMBypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)EPSS 0.3%CVE-2026-32947MEDIUMEgress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)EPSS 0.3%CVE-2026-32946MEDIUMEgress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)EPSS 0.3%